fix(adapters): default legacy harnesses and connected tools to full auto (#13693)

## Thinking Path

> - Paperclip lets people manage AI agents and their work.
> - Legacy adapters launch provider CLIs and expose connected tools.
> - Existing defaults did not consistently grant full automatic
permission.
> - Remote Claude used a fixed tool list that omitted MCP tools and
future tools.
> - Direct Codex launches and OpenCode configuration also used narrower
defaults.
> - This change gives all these paths the same full-auto default as
native runners.
> - Explicit restrictive settings continue to work.

## Linked Issues or Issue Description

Refs #13686. This PR is stacked on that native-runner and
task-reassignment PR. Merge #13686 first.

Related: #831 (constructed Claude agents), #1935 (adapter-switching
permission defaults).

## What Changed

- Use actual Claude permission bypass for local and remote runs and
probes. Remove the fixed tool list so MCP and future provider tools are
included.
- Identify actual managed sandbox targets to Claude with `IS_SANDBOX=1`.
Do not mark ordinary host execution as a sandbox.
- Default direct Codex execution to approval and sandbox bypass,
matching agent creation. Preserve explicit false, CLI profiles, sandbox
modes, approval policy, and network restrictions.
- Set OpenCode's full-auto runtime permission to `allow` for every tool
and connection. Preserve the existing explicit opt-out.
- Default Gemini probes to the same YOLO mode as execution. Make the
legacy ACP `default` alias use `approve-all` for fresh and resumed
sessions.
- Add default, opt-out, remote, probe, connected-tool, and resume
regression tests. Update adapter configuration documentation.
- Other adapter paths already request full automatic permission or have
no provider approval gate.

## Verification

- Full workspace `pnpm -r typecheck` and `pnpm build` passed locally
after rebasing onto current master. Targeted adapter/server and legacy
ACP tests passed, including defaults, explicit opt-outs, remote
launches, connected tools, and fresh/resumed sessions.
- Greptile reviewed current head
`8ca135eaffcf9cfdba6f1368e896a781a0891d50` at **5/5**. The security
reviewer acknowledged the documented full-auto requirement. Acknowledged
discussions are resolved.
- Current head has **54 passing checks**. [PR
checks](https://github.com/paperclipai/paperclip/pull/13693/checks). The
process-adapter signoff browser shard passed on one retry after its
first attempt exceeded a three-second issue-run wait.
- **Six native Claude/Codex real-provider cases passed on their first
attempt, with cleanup passing**, against the combined branch: plans,
reassignment, and backlog creation/status. [Campaign and downloadable
evidence](https://github.com/paperclipai/paperclip/actions/runs/35469926548).
This does not claim a real-provider run of every legacy adapter.
- The live-tested revision is
`a37881c824dcd7170380fc4b788732fc743e5da7`. The current head differs
only in the corrected heartbeat test expectation; application code is
identical.
- The campaign result-enforcement job passed. The separate report
publisher failed during frozen dependency installation because the
trusted workflow's patched-dependency configuration does not match its
lockfile. Passing case evidence remains downloadable from the workflow.
- Full-suite coverage comes from CI partitions. The separate unsharded
local run was stopped after the corresponding CI partitions passed; it
is not counted as a completed local run.

## Risks

- Missing permission settings now grant all provider operations,
including connected tools. OpenCode full-auto also overrides ambient
provider permission rules. An explicit Paperclip permission opt-out
preserves restrictive behavior.
- Claude refuses full bypass as root outside an identified sandbox.
Ordinary host deployments must run Claude as a non-root user. Managed
sandbox launches include the required marker.
- These defaults do not grant additional Paperclip roles, connections,
or company access. Existing controller authorization and governance
still apply.
- This PR depends on #13686. Retarget it to master after that PR merges.

## Model Used

OpenAI Codex, based on GPT-6, with code execution and repository tools.
The exact deployment model ID and context-window size are not exposed in
this session.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

Co-authored-by: Paperclip <noreply@paperclip.ing>

Author: cryppadotta

packages/adapter-utils/src/acpx-engine/execute.test.ts

@@ -369,6 +369,29 @@ const ALLOWED_TURN_SPAN_ATTRIBUTE_KEYS = new Set<string>([
 ]);
 
 describe("shared ACPX engine runtime behavior", () => {
+  it.each(["claude", "codex", "gemini", "kimi", "custom"])("defaults the legacy %s engine to full auto on fresh and resumed runs", async (agent) => {
+    const root = await makeTempRoot();
+    const config = {
+      agent, cwd: root, stateDir: path.join(root, "state"),
+      ...(agent === "custom" ? { agentCommand: "node ./fake-acp.js" } : {}),
+    };
+    const first = await runExecutor(config);
+    const resumed = await runExecutor(config, { runtime: { sessionParams: first.result.sessionParams } });
+    for (const run of [first, resumed]) {
+      expect(run.runtimeOptions[0]?.permissionMode).toBe("approve-all");
+      expect(run.result.resultJson?.permissionMode).toBe("approve-all");
+    }
+  });
+
+  it.each([
+    ["default", "approve-all"], ["", "approve-all"],
+    ["approve-reads", "approve-reads"], ["deny-all", "deny-all"],
+  ])("resolves the legacy %j permission setting to %s", async (permissionMode, expected) => {
+    const root = await makeTempRoot();
+    const run = await runExecutor({ agent: "custom", agentCommand: "node ./fake-acp.js", cwd: root, stateDir: path.join(root, "state"), permissionMode });
+    expect(run.runtimeOptions[0]?.permissionMode).toBe(expected);
+  });
+
   it("persists ACP agent process identity before prompting on each run (host lane re-creates, no warm reuse)", async () => {
     const root = await makeTempRoot();
     const startedAt = "2026-07-30T07:00:00.000Z";

packages/adapter-utils/src/acpx-engine/execute.ts

@@ -1422,7 +1422,7 @@ function normalizeMode(config: Record<string, unknown>): "persistent" | "oneshot
 function normalizePermissionMode(config: Record<string, unknown>): "approve-all" | "approve-reads" | "deny-all" {
   const value = asString(config.permissionMode, DEFAULT_ACP_ENGINE_PERMISSION_MODE).trim();
   if (value === "approve-reads" || value === "deny-all") return value;
-  if (value === "default") return "approve-reads";
+  if (value === "default") return DEFAULT_ACP_ENGINE_PERMISSION_MODE;
   return "approve-all";
 }
 

packages/adapters/claude-local/src/index.ts

@@ -53,7 +53,7 @@ Core fields:
 - chrome (boolean, optional): pass --chrome when running Claude
 - promptTemplate (string, optional): run prompt template
 - maxTurnsPerRun (number, optional): max turns for one run
-- dangerouslySkipPermissions (boolean, optional, default true): allow non-interactive Claude runs to proceed without approval prompts. Local targets receive --dangerously-skip-permissions; remote targets receive a curated --allowedTools list so they do not inherit local bypass permissions.
+- dangerouslySkipPermissions (boolean, optional, default true): allow non-interactive Claude runs to proceed without approval prompts. Local and remote targets receive --dangerously-skip-permissions for all built-in and connected tools. Managed sandbox targets also identify themselves to Claude so root container launches support bypass. Non-sandbox root processes must run Claude as a non-root user; Paperclip does not silently downgrade the requested mode.
 - command (string, optional): defaults to "claude"
 - extraArgs (string[], optional): additional CLI args
 - env (object, optional): KEY=VALUE environment variables

packages/adapters/claude-local/src/server/acp.ts

@@ -54,7 +54,7 @@ import {
 import { createWorkspaceRestoreTeardown } from "@paperclipai/adapter-utils/workspace-restore-teardown";
 import { buildLocalAdapterTestProbeEnv } from "./probe-env.js";
 import { detectClaudeLoginRequired, extractClaudeRetryNotBefore, isClaudeProviderQuotaError, parseClaudeStreamJson } from "./parse.js";
-import { buildClaudeProbePermissionArgs } from "./permissions.js";
+import { buildClaudeProbePermissionArgs, claudeSandboxPermissionEnv } from "./permissions.js";
 import { ADAPTER_AUTH_MISSING_CHECK_CODE } from "./auth-check.js";
 import { resolveClaudeModel, SANDBOX_INSTALL_COMMAND } from "../index.js";
 
@@ -647,6 +647,9 @@ export async function probeClaudeAcpSandboxLogin(input: {
     cwd = asString(config.cwd, process.cwd());
   }
 
+  Object.assign(env, claudeSandboxPermissionEnv({
+    dangerouslySkipPermissions: asBoolean(config.dangerouslySkipPermissions, true), targetIsSandbox,
+  }));
   const args = ["--print", "-", "--output-format", "stream-json", "--verbose"];
   if (config.managedAiConnection) args.push("--setting-sources", "user");
   args.push(

packages/adapters/claude-local/src/server/execute.remote.test.ts

@@ -193,11 +193,8 @@ describe("claude remote execution", () => {
       | [string, string, string[], { env: Record<string, string>; remoteExecution?: { remoteCwd: string } | null }]
       | undefined;
     expect(call?.[2]).toEqual(expect.arrayContaining(["--model", "claude-opus-5"]));
-    expect(call?.[2]).toContain("--allowedTools");
-    expect(call?.[2]).toContain(
-      "Task AskUserQuestion Bash CronCreate CronDelete CronList Edit EnterPlanMode EnterWorktree ExitPlanMode ExitWorktree Glob Grep Monitor NotebookEdit PushNotification Read RemoteTrigger ScheduleWakeup Skill TaskOutput TaskStop TodoWrite ToolSearch WebFetch WebSearch Write",
-    );
-    expect(call?.[2]).not.toContain("--dangerously-skip-permissions");
+    expect(call?.[2]).toContain("--dangerously-skip-permissions");
+    expect(call?.[2]).not.toContain("--allowedTools");
     expect(call?.[2]).toContain("--append-system-prompt-file");
     expect(call?.[2]).toContain(
       `${managedRemoteWorkspace}/.paperclip-runtime/claude/skills/agent-instructions.md`,

packages/adapters/claude-local/src/server/execute.ts

@@ -92,7 +92,7 @@ import {
 import { resolveClaudeDesiredSkillNames } from "./skills.js";
 import { isBedrockModelId } from "./models.js";
 import { prepareClaudePromptBundle } from "./prompt-cache.js";
-import { buildClaudeExecutionPermissionArgs } from "./permissions.js";
+import { buildClaudeExecutionPermissionArgs, claudeSandboxPermissionEnv } from "./permissions.js";
 import { resolveClaudeModel, SANDBOX_INSTALL_COMMAND } from "../index.js";
 import {
   createClaudeAcpExecutor,
@@ -480,6 +480,7 @@ export async function execute(ctx: AdapterExecutionContext): Promise<AdapterExec
     graceSec,
     extraArgs,
   } = runtimeConfig;
+  Object.assign(env, claudeSandboxPermissionEnv({ dangerouslySkipPermissions, targetIsSandbox: executionTargetIsSandbox }));
   let loggedEnv = initialLoggedEnv;
   let effectiveExecutionCwd = adapterExecutionTargetRemoteCwd(executionTarget, cwd);
   const terminalResultCleanupGraceMs = Math.max(
@@ -937,7 +938,7 @@ export async function execute(ctx: AdapterExecutionContext): Promise<AdapterExec
     }
     if (dangerouslySkipPermissions && executionTargetIsRemote) {
       commandNotes.push(
-        "Using a broad --allowedTools whitelist for remote execution so hosted targets do not inherit local Claude bypass permissions.",
+        "Using full Claude permission bypass for remote execution, including connected tools.",
       );
     }
     if (attemptInstructionsFilePath && !resumeSessionId) {

packages/adapters/claude-local/src/server/permissions.test.ts

@@ -1,79 +1,23 @@
 import { describe, expect, it } from "vitest";
-import { buildClaudeExecutionPermissionArgs, buildClaudeProbePermissionArgs } from "./permissions.js";
-
-const SANDBOX_ALLOWED_TOOLS =
-  "Task AskUserQuestion Bash CronCreate CronDelete CronList Edit " +
-  "EnterPlanMode EnterWorktree ExitPlanMode ExitWorktree Glob Grep Monitor " +
-  "NotebookEdit PushNotification Read RemoteTrigger ScheduleWakeup Skill " +
-  "TaskOutput TaskStop TodoWrite ToolSearch WebFetch WebSearch Write";
-
-describe("claude-local remote permission args", () => {
-  it("uses the canonical Bash tool grant for remote execution", () => {
-    expect(buildClaudeExecutionPermissionArgs({ dangerouslySkipPermissions: true, targetIsRemote: true })).toEqual([
-      "--allowedTools",
-      SANDBOX_ALLOWED_TOOLS,
-    ]);
-  });
-
-  it("uses the canonical Bash tool grant for remote probes", () => {
-    expect(buildClaudeProbePermissionArgs({ dangerouslySkipPermissions: true, targetIsRemote: true })).toEqual([
-      "--allowedTools",
-      SANDBOX_ALLOWED_TOOLS,
-    ]);
-  });
-
-  it("does not use Bash(*) because Claude Code treats Bash grants as command-prefix patterns", () => {
-    const [, allowedTools] = buildClaudeExecutionPermissionArgs({
-      dangerouslySkipPermissions: true,
-      targetIsRemote: true,
+import { buildClaudeExecutionPermissionArgs, buildClaudeProbePermissionArgs, claudeSandboxPermissionEnv } from "./permissions.js";
+
+describe("Claude full-auto permission args", () => {
+  for (const [name, build] of [["execution", buildClaudeExecutionPermissionArgs], ["probe", buildClaudeProbePermissionArgs]] as const) {
+    it.each([
+      { targetIsRemote: false, localProcessUid: 1000 },
+      { targetIsRemote: true, localProcessUid: 1000 },
+      { targetIsRemote: false, localProcessUid: 0 },
+      { targetIsRemote: true, localProcessUid: 0 },
+    ])(`${name} requests full bypass for %j`, (target) => {
+      expect(build({ ...target, dangerouslySkipPermissions: true }))
+        .toEqual(["--dangerously-skip-permissions"]);
+      expect(build({ ...target, dangerouslySkipPermissions: false })).toEqual([]);
     });
+  }
 
-    expect(allowedTools.split(" ")).toContain("Bash");
-    expect(allowedTools).not.toContain("Bash(*)");
-  });
-
-  it("does not pass permission flags when skip-permissions is disabled", () => {
-    expect(buildClaudeExecutionPermissionArgs({ dangerouslySkipPermissions: false, targetIsRemote: true })).toEqual([]);
-    expect(buildClaudeProbePermissionArgs({ dangerouslySkipPermissions: false, targetIsRemote: true })).toEqual([]);
-  });
-
-  it("uses dangerously-skip-permissions for non-root local execution", () => {
-    expect(
-      buildClaudeExecutionPermissionArgs({
-        dangerouslySkipPermissions: true,
-        targetIsRemote: false,
-        localProcessUid: 1000,
-      }),
-    ).toEqual(["--dangerously-skip-permissions"]);
-  });
-
-  it("uses dangerously-skip-permissions for non-root local probes", () => {
-    expect(
-      buildClaudeProbePermissionArgs({
-        dangerouslySkipPermissions: true,
-        targetIsRemote: false,
-        localProcessUid: 1000,
-      }),
-    ).toEqual(["--dangerously-skip-permissions"]);
-  });
-
-  it("uses allowedTools for local root execution because Claude refuses dangerously-skip-permissions as root", () => {
-    expect(
-      buildClaudeExecutionPermissionArgs({
-        dangerouslySkipPermissions: true,
-        targetIsRemote: false,
-        localProcessUid: 0,
-      }),
-    ).toEqual(["--allowedTools", SANDBOX_ALLOWED_TOOLS]);
-  });
-
-  it("uses allowedTools for local root probes because Claude refuses dangerously-skip-permissions as root", () => {
-    expect(
-      buildClaudeProbePermissionArgs({
-        dangerouslySkipPermissions: true,
-        targetIsRemote: false,
-        localProcessUid: 0,
-      }),
-    ).toEqual(["--allowedTools", SANDBOX_ALLOWED_TOOLS]);
+  it("identifies managed sandboxes for Claude's root launch check only when full auto is enabled", () => {
+    expect(claudeSandboxPermissionEnv({ dangerouslySkipPermissions: true, targetIsSandbox: true })).toEqual({ IS_SANDBOX: "1" });
+    expect(claudeSandboxPermissionEnv({ dangerouslySkipPermissions: false, targetIsSandbox: true })).toEqual({});
+    expect(claudeSandboxPermissionEnv({ dangerouslySkipPermissions: true, targetIsSandbox: false })).toEqual({});
   });
 });

packages/adapters/claude-local/src/server/permissions.ts

@@ -1,53 +1,23 @@
-// Explicit allowlist of Claude Code tools we permit when running on a remote
-// target. We use this instead of `--dangerously-skip-permissions` for remote
-// targets because the permission-approval prompts can't be answered by a
-// human inside a non-interactive run, but blanket-allowing every tool would
-// defeat the point of having a separate hosted/sandbox code path.
-//
-// Maintenance: this list must be reviewed when Claude Code releases a new
-// tool. The canonical list of built-in tools is documented at
-// https://docs.claude.com/en/docs/claude-code/built-in-tools — when a tool
-// is added there, decide whether it should be allowed in remote runs and
-// either add it here or document the deliberate exclusion. Omitting a tool
-// silently disables it inside remote targets, which can look like the tool is
-// "broken" rather than intentionally gated.
-const SANDBOX_ALLOWED_TOOLS =
-  "Task AskUserQuestion Bash CronCreate CronDelete CronList Edit " +
-  "EnterPlanMode EnterWorktree ExitPlanMode ExitWorktree Glob Grep Monitor " +
-  "NotebookEdit PushNotification Read RemoteTrigger ScheduleWakeup Skill " +
-  "TaskOutput TaskStop TodoWrite ToolSearch WebFetch WebSearch Write";
-
-function shouldUseAllowedTools(input: { targetIsRemote: boolean; localProcessUid?: number | null }): boolean {
-  // Claude Code refuses `--dangerously-skip-permissions` when the process runs
-  // as root. Use the same explicit allowlist that remote targets use so local
-  // Docker/root probes and executions fail safe instead of hard-failing before
-  // auth/runtime validation can complete.
-  return input.targetIsRemote || input.localProcessUid === 0;
-}
-
-export function buildClaudeProbePermissionArgs(input: {
+interface ClaudePermissionInput {
   dangerouslySkipPermissions: boolean;
   targetIsRemote: boolean;
   localProcessUid?: number | null;
-}): string[] {
-  if (!input.dangerouslySkipPermissions) return [];
-  // For remote targets and local root processes, mirror the execution path:
-  // pass `--allowedTools` with the curated allowlist instead of dropping the
-  // flag entirely. The hello probe is a one-shot prompt that should never
-  // trigger a tool, but if a future probe prompt does, we don't want Claude CLI
-  // to stall on an interactive permission prompt that no human can answer.
-  if (shouldUseAllowedTools(input)) return ["--allowedTools", SANDBOX_ALLOWED_TOOLS];
-  return ["--dangerously-skip-permissions"];
 }
 
-export function buildClaudeExecutionPermissionArgs(input: {
+// Permission defaults are identical for local, remote, and connected tools.
+// A tool allowlist is not equivalent to full bypass: it misses MCP tools and
+// tools added by later provider releases. Let Claude enforce its own launch
+// requirements rather than silently downgrading the requested permission mode.
+export function buildClaudeExecutionPermissionArgs(input: ClaudePermissionInput): string[] {
+  return input.dangerouslySkipPermissions ? ["--dangerously-skip-permissions"] : [];
+}
+
+export const buildClaudeProbePermissionArgs = buildClaudeExecutionPermissionArgs;
+
+/** Claude permits full bypass as root only inside an identified sandbox. */
+export function claudeSandboxPermissionEnv(input: {
   dangerouslySkipPermissions: boolean;
-  targetIsRemote: boolean;
-  localProcessUid?: number | null;
-}): string[] {
-  if (!input.dangerouslySkipPermissions) return [];
-  if (shouldUseAllowedTools(input)) {
-    return ["--allowedTools", SANDBOX_ALLOWED_TOOLS];
-  }
-  return ["--dangerously-skip-permissions"];
+  targetIsSandbox: boolean;
+}): Record<string, string> {
+  return input.dangerouslySkipPermissions && input.targetIsSandbox ? { IS_SANDBOX: "1" } : {};
 }

packages/adapters/claude-local/src/server/test.ts

@@ -32,7 +32,7 @@ import {
   readClaudeCommandVersion,
 } from "./cli-capabilities.js";
 import { isBedrockModelId } from "./models.js";
-import { buildClaudeProbePermissionArgs } from "./permissions.js";
+import { buildClaudeProbePermissionArgs, claudeSandboxPermissionEnv } from "./permissions.js";
 import { prepareSandboxClaudeProbeRuntime } from "./claude-config.js";
 import { resolveClaudeModel, SANDBOX_INSTALL_COMMAND } from "../index.js";
 import { resolveClaudeExecutionEngineForRun, testClaudeAcpEnvironment } from "./acp.js";
@@ -322,6 +322,7 @@ export async function testEnvironment(
       const chrome = asBoolean(config.chrome, false);
       const maxTurns = asNumber(config.maxTurnsPerRun, 0);
       const dangerouslySkipPermissions = asBoolean(config.dangerouslySkipPermissions, true);
+      Object.assign(env, claudeSandboxPermissionEnv({ dangerouslySkipPermissions, targetIsSandbox }));
       const extraArgs = (() => {
         const fromExtraArgs = asStringArray(config.extraArgs);
         if (fromExtraArgs.length > 0) return fromExtraArgs;